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ABSTRACT 

^ This  paper  addresses  the  problem  of  developing  an  expert  system  to  aid  the  G2 
intelligence  analyst  in  performing  the  tactical  indications  of  warning  task. 
These  include  assimilating  numerous  reports  based  on  sensor  and  intelligence 
data  (in  signal  and  symbol  form);  combining  such  knowledge  with  information 
pertaining  to  terrain,  weather  patterns,  enemy  organization,  equipment  and 
general  cababilities;  and  predicting  significant  events  in  a battlefield 
environment  such  as  numerical  changes  of  enemy  forces,  enemy  attack  at  key 
positions,  unusual  deployment  of  forces  and  equipment,  and  so  forth.  ^ The 
specific  problem  areas  investigated  for  expert  systems  technology  applications 
include  activation  of  tactical  indicators;  indicator  relationships  (how  the 
activity  of  some  indicators  can  be  predicted/inferred  from  others); 
identification  of  information  gaps  and  collection  tasking  (identifying  the 
critical  elements  of  information  that  are  not  available  for  making  reliable  l&W 
assessments,  such  as  definitive  indicator  activation  and  how  to  task  , ensors  to 
obtain  them);  and  tactical  warning.  The  approach  suggested  by  the  current 
work  consists  of  incorporating  expert  knowledge  into  condition/action  rules 
and  developing  appropriate  frame  structures  for  various  categories  of  sensor 
and  intelligence  reports.  A global  two-dimensional  data  structure  is  used  to 
accommodate  specific  reports  from  very  different  sources,  efficiently  trigger 
relevant  rules,  and  keep  the  human  analyst  abreast  of  the  developing  threat 
situation.  Each  rule  is  also  represented  as  a frame,  facilitating  browsing 
through  the  rules,  adding  new  rules,  and  assigning  credit  and  blame  to  rules. 
Such  representation  is  currently  a very  useful  feature  in  the  development  of  a 
strategic  l&W  prototype  expert  system. 


INTRODUCTION 


The  application  of  expert  systems 
techniques  to  the  problem  of  tactical 
battlefield  indications  and  warning  (I 
and  W)  appears  extremely  promising. 
Discussion  with  U.S.  Army 

commanders,  line  officers,  and  retired 


officers  has  led  to  emphasis  on  the 
following  requirements  in  developing 
such  applications: 


• Development  of  battlefield  threat 
scenarios  which  distribute  tactical 
indicators  chronologically. 
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• Identification  of  the  types  and 
sources  of  intelligence  reports 
associated  with  the  various 
classes  of  tactical  indicators. 

• Acquisition  of  expert  knowledge 
on  tactical  I and  W decision  and 
assessment  criteria  for  the  fol- 
lowing: 

a.  Indicator  activation 

b.  Indicator  relationships 

across  time 

c.  Identification  of  incomplete 
and/or  unreliable  report 
information 

d.  Collection  system  tasking 

e.  Tactical  warning. 

• Design  and  development  of  a 
prototype  tactical  I and  W 
expert  system. 


BACKGROUND 


Based  on  several  years  of  contract 
work  in  the  areas  of  (I)  mission  plan- 
ning and  management,  and  (2)  strate- 
gic I and  W analysis,  ESL  has  gained 
substantial’  experience  in  understand- 
ing intelligence  problems  and  develop- 
ing computer-based  support  for  intelli- 
gence analysis  tasks.  The  relevant 
work  includes  the  following: 

a.  Several  years  of  work  in  I and  W 
analysis  under  contract  to 
DARPA.  Work  has  involved 
extended  on-site  research  at 
CINCPAC/IPAC  and  has  lead  to 
an  experimental  computer-based 
analytical  modeling  and  manage- 
ment technology. 


b.  Ongoing  ID  projects  to  develop 
expert  systems  for  strategic  I 
and  W analysis  and  interpreta- 
tion of  tactical  battlefield 
communications  intelligence 
data  for  the  purpose  of  commun- 
ications net  reconstruction. 


PROBLEM  DISCUSSION 


Accurate  and  reliable  tactical  know- 
ledge about  the  enemy  and  the  area  of 
operations  is  vital  to  command  deci- 
sion making  in  a battlefield  environ- 
ment. Such  information  is  the  product 
of  tactical  I and  W tasks  performed  by 
experienced  G2  analysts.  They  must 
assimilate  numerous  reports  based  on 
sensor  and  intelligence  data,  and  com- 
bine the  reports  with  facts  pertaining 
to  terrain,  weather  patterns,  enemy 
organization,  equipment,  and  general 
combat  capabilities.  Significant 
changes  or  events  can  then  be  pre- 
dicted. Important  questions  include 
whether  the  enemy  will  attack, 
defend,  reinforce  or  withdraw,  and,  if 
so,  when,  where  and  in  what  strength 
these  conditions  will  occur.  It  is  also 
important  to  distinguish  enemy  inten- 
tions and  capabilities.  Do  the  capabil- 
ities support  the  indicators  or  is  the 
enemy  trying  to  conceal  his  true 
intentions? 


These  assessments  must  not  cnly  be 
dependable  but  also  timely. 

Thus,  tactical  I and  W analysis  has  the 
following  characteristics: 

• The  problem  domain  is  complex. 
A diverse  set  of  decision  criteria 
and  heuristics  is  required  to 
integrate  the  report  data  from 
various  sensors,  factor  in 


knowledge  about  the  enemy's 
tactics  and  modus  operandi,  and 
then  assess  developing  threat 
situations  accordingly. 

• Experience  is  essential.  The 
effective  performance  of  I and 
W analytic  tasks  requires  exper- 
ience, training,  and  a detailed 
data  base.  The  voluminous  intel- 
ligence data  produced  by  modern 
collection  systems  must  be 
meaningfully  interpreted  and 
properly  assessed  in  terms  of 
rapidly  changing  threat  environ- 
ments. This  is  accomplished  pri- 
marily by  relying  on  the  skills 
and  knowledge  of  experienced 
trained  analysts. 


• Knowledge  is  dynamic.  Assess- 
ment of  enemy  capabilities  is 
based  not  only  on  past  enemy 
actions,  but  also  on  current 
enemy  force  characteristics  and 
the  present  situation.  These  ele- 
ments are  influenced  by  factors 
such  as  new  weapon  systems 
(which  could  be  in  various  devel- 
opmental stages  such  as  R&D, 
production,  development,  and  so 
forth),  new  collection  systems, 
current  and  developing  political 
and  economic  conditions,  and  so 
on.  Such  information  greatly 
impacts  the  need  for  frequent 
updates  and  reevaluation  of  the 
knowledge  base  required  for  the 
I and  W analytic  tasks. 


These  and  other  complexities  of  tac- 
tical warning  mandate  the  application 
of  expert  systems  technology.  Expert 
systems  will  increase  productivity  and 
efficiency  in  performing  timely  I and 
W analytic  tasks.  Expert  systems  will 
also  improve  I and  W training  in  order 
to  overcome  the  scarcity  of  I and  W 


expertise  and  the  high  turnover  rate  of 
I and  W analysts.  The  following  sec- 
tions describe  some  of  the  necessary 
steps  for  such  applications. 


INDICATORS  AND  THREAT  SCENARIOS 


The  I and  W analyst  does  not  draw 
high-level  conclusions  about  enemy 
intentions  directly  from  incoming  sen- 
sor and  intelligence  reports,  any  more 
than  a physician  makes  a diagnosis 
directly  from  a patient's  symptoms.  In 
each  case  there  are  one  or  more  inter- 
mediate levels  of  abstraction  at  which 
the  expert  reasons.  The  physician 
repeatedly  combines  several  symptoms 
into  a more  general,  more  systematic 
indicator  (e.g.,  specific  temperature 
readings  over  a three  day  period  may 
combine  into  "fever  slowly  increas- 
ing"). Similarly,  the  I and  W analyst 
may  combine  many  reports  of  specific 
enemy  activity  (e.g..  attack  formation 
of  regimental  and  divisional  troops  in 
certain  key  areas)  into  a general  con- 
clusion (e.g.,  "deployment  of  combat 
elements  in  echelon").  Such  general 
statements  are  called  indicators,  (i.e., 
classes  of  activities  which  signal  an 
important  change  in  the  threat  posture 
of  an  enemy  force).  An  indicator 
becomes  active  when  it  is  determined 
that  such  a change  has  taken  place. 
The  expert  can  then  reason  from  a 
small  set  of  activated  indicators  and 
go  back  to  the  original  data  just  as  a 
check  of  his  conclusions.  An  indicator 
may  be  thought  of  as  a way  of  symbol- 
ically, rather  than  statistically, 
"reducing"  a huge  mass  of  incoming 
data. 

A time  sequence  of  indicators  (i.e., 
expert  "Artillery  well  forward  and 
massed,"  then  "Maneuver  forces  in 
pre-assault  formations,"  and  so  forth) 


and  a collection  of  threats  (at  various 
levels  of  generalization)  spanning  the 
same  time  pericd  is  called  a threat 
scenario.  The  first  step  is  to  select  a 
useful  set  of  indicators  which  would 
generate  viable  threats  and  threat 
scenarios  and  provide  the  basis  upon 
which  to  explore  the  utility  of  tactical 
I and  W expert  systems. 

Table  I contains  a sample  list  of 
attack  and  defense  intelligence  indica- 
tors. An  example  of  a tactical  threat 
scenario  is  presented  in  Figure  I. 


SENSOR  AND  INTELLIGENCE 
DATA  ORGANIZATION 


This  step  is  essentially  the  initial 
phase  of  the  knowledge  acquisition 
process  discussed  below.  Based  on  (I) 
relevant  intelligence  documentation, 
(2)  existing  sensor  capabilities,  and  (3) 
knowledge  of  experienced  analysts, 
generic  report  categories  will  be 
developed  for  each  indicator  that  can 
accommodate  specific  information 
pertaining  to  the  activity  levels. 
Figure  2 is  an  example  of  an  indicator 
and  some  of  its  possible  associated 
report  categories. 

Each  report  category  should  be  further 
defined  in  terms  of  additional  para- 
meters. These  parameters  are  based 
on  the  following  factors: 

• Expectations  about  observed 
events 

• Pertinent  geographical  features 

• Types  and  reliability  of  sensors 
and  intelligence  sources. 

This  defines  a format  in  which  incom- 
ing reports  will  arrive.  Each  report 
will  have  specific  values  given  by  sen- 


sor and  intelligence  data  and  by  know- 
ledge about  sensor  characteristics, 
expected  events,  and  geographical 
areas.  An  example  of  a report  per- 
taining to  the  Increased  Engineering 
Operations  indicator  as  shown  in 
Figure  2,  and  belonging  to  the  road- 
and-bridge  repair  category,  is  given  in 
Table  2.  For  each  item  on  this  list, 
the  name  of  the  corresponding  para- 
meter is  on  the  left-hand  side  of  the 
colon  sign  and  the  value  appears  on 
the  right-hand  side.  In  most  cases,  the 
latter  is  a symbolic  expression  rather 
than  an  actual  numeric  value. 


KNOWLEDGE  ACQUISITION 


The  knowledge  acquisition  process  is 
probably  the  most  critical  phase  in  the 
development  of  an  expert  system.  It 
consists  of  acquiring  a body  of  know- 
ledge adequate  for  achieving  an  expert 
problem-solving  performance  in  the 
specific  task  domain.  Knowledge 
sources  include  the  following: 

• Published  material  such  as  text- 
books, documents,  and  so  forth 
about  the  domain  and  its  pro- 
blem-solving methods. 

• Examples  of  problem-solving 
instances. 

• Experts'  past  problem-solving 
experience. 

• Experts'  knowledge  relevant  to 
problem  solving. 

For  complex  and  dynamical  changing 
task  domains  such  as  tactical  I and  W 
analysis,  the  last  two  types  of  know- 
ledge play  a key  role  in  the  successful 
development  of  expert  systems.  Thus, 
in  addition  to  information  extracted 
from  documentation  on  militory  doc- 
trine and  tactics,  the  development  of 


ATTACK 

Attack  may  be  indicated  by-- 
ACTIVITY 

Massing  of  mechanized  elements,  tanks, 
artillery,  and  logistical  support. 


Deployment  of  combat  elements  (mech- 
anized, armor,  antitank)  in  echelon. 


Forward  units  disposed  on  relatively 
narrow  fronts. 

DEFENSE 

Defense  may  be  indicated  by-- 
ACTIVITY 

Preparation  of  batallion  and  company 
defense  areas. 


Extensive  preparation  of  field  forti 
fications. 


Formation  of  antitank  strongpoints . 


Attachment  of  additional  antitank  units 
to  frontline  defensive  positions. 


EXPLANATION 

Areas  of  secondary  importance  are  often 
denuded  to  mass  maximum  strength  tor 
main  effort. 

Normal  attack  formation  provides  for 
second  echelon  of  the  regiment  to  be 
located  3-6  kilometers  in  rear  of  the 
first  echelon  on  1ine;  division  second 
echelon  6-8  kilometers  in  rear  of  first 
echelon;  and  army  second  echelon  15-25 
kilometers  in  rear  of  first  echelon. 

The  actual  attack  zone  of  a mechanized 
regiment  is  about  4 kilometers  within 
an  assigned  frontage  which  varies  from 
5 to  8 kilometers. 


EXPLANATION 

Defense  is  based  on  stubborn  defense  of 
batallion  defensive  areas,  and  counter- 
attacks by  tank  heavy  forces. 

The  enemy  makes  extensive  use  of  tren- 
ches, prepared  positions,  and  overhead 
cover  in  defensive  operations. 

Antitank  strongpoints  are  formed  along 
logical  avenues  of  approach  for  armor. 
These  are  made  up  of  mechanized  engi- 
neer, and  antitank  gun  units  with 
positions  strengthened  by  mines,  ditch- 
es, and  other  obstacles 

In  areas  where  there  is  a serious  armored 
threat,  the  enemy  will  concentrate  as 
many  as  25  antitank  guns  for  every  1,000 
meters  of  front. 
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Table  1.  Typical  Intelligence  Indicators  — Continued 


ACTIVITY 

Preparation  of  alternate  artillary 
positions. 


Employment  of  roving  artillery. 


Large  tank  units  located  in  assembly 
areas  to  the  rear. 

Preparation  and  occupation  cf  successive 
defense  lines. 

Piesence  of  demolitions,  contaminated 
areas,  obstacles,  and  minefields. 


Deployment  of  mechanized  units  on  good 
defensive  positions. 


Dumping  ammunition  and  engineering 
supplies  and  equipment  and  fortifying 
buildings . 

Entrenching  and  erecting  bands  of  wire. 


EXPLANATION 

In  normal  defensive  operations,  three 
positions  are  prepared  for  each  firing 
battery. 

Roving  guns  are  part  of  normal  defensive 
operations. 

Tank  units  are  hold  in  assembly  areas 
for  employment  in  counterattack  roles. 

In  the  defense,  separate  and  distinct 
defense  lines  are  prepared  and  occupied. 

Demolitions  and  minefields  and  other 
obstacles  are  placed  to  cover  approaches 
to  the  position. 

Dominating  terrain  that  has  good  fields 
of  fire  and  is  relatively  inaccessable 
to  tanks  usually  is  selected  for  a 
defensive  position. 

Engineering  tools  and  equipment  may  be 
used  to  dig  trenches  and  to  erect 
obstacles. 

Digging  of  trenches  and  the  erection  of 
of  wire  indicate  preparations  to  hold 
the  position. 
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Table  2.  Example  Report 


Description.- 
Unit  ID: 


Location: 

Number  and  Size  of  Equipment: 


Terrain: 

Sensor  Type: 

Sensor  Certainty: 

Time: 

Related  Indicators 


the  knowledge  base  of  the  proposed 
prototype  tactical  I and  W expert  sys- 
tem will  incorporate  facts,  proce- 
dures, and  heuristics  supplied  by  in- 
house  and  Government-designated 
experts.  Experts  will  be  interviewed 
about  how  they 


Repairs  of  roads  and  bridges. 

Personnel  wearing  engineer  insignia  and 
vehicles  containing  distinctive  engineer 
corps  markings  and  distinctive  engineer 
equipment. 

Forward  areas  of  divisional  sector  DS17. 

Heavy  road  repair  machinery  observed  in 
numbers  greater  than  those  organic  to  the 
division. 

Largely  forest  area  with  trails  only. 

Imagery,  POW,  and  refugee  information. 

On  a scale  from  0 to  100,  80  for  imagery, 
50  for  POW,  and  30  for  refugee  reports. 

15  June  1983,  1500  hrs. 

Increased  Engineering  Operations. 


Rules*  will  be  developed  for  these 
analytic  tasks.  In  general,  the  rules 
will  be  influenced  by  various  factors. 
For  example,  the  indicator  activation 
criteria  must  be  based  both  on  the 
types  and  nature  of  data  in  specific 
reports  and  on  relationships  among 
indicators.  Furthermore,  the  level  of 
completeness  of  the  specific  reports 
and  the  reliability  of  their  sources  will 
result  in  rules  that  conclude  activation 
with  varying  degrees  of  certainty. 


• Know  when  to  activate  each 
indicator. 

• Identify  vital  but  missing  pieces 
of  information,  which  would 
heavily  affect  their  decisions 
(this  drives  collection  tasking). 

• Read  patterns  to  conclude  that 
certain  scenarios  may  be  in  pro- 
gress (this  provides  tactical 
warning). 


* By  a "rule"  we  do  not  mean  a rigid 
constraint  such  as  a rule  of  a card 
game.  Rather,  we  mean  a flexible 
guide  to  plausible  action  or  decision- 
making, a rule  of  good  judgement  and 
good  guessing. 
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In  particular,  knowledge  about  indi- 
cator relationships  will  be  important 
for  two  reasons.  First,  based  on  cur- 
rent indicator  activity,  meaningful 
hypotheses  could  be  made  about  veri- 
fying, expecting,  and  predicting  threat 
developments  in  the  past,  present,  and 
future.  Secondly,  the  cover  and 
deception  aspects  of  incoming  report 
data  could  be  minimized.  This  means 
that  reliable  rules  about  activating  a 
certain  indicator  should  be  based  not 
only  on  specific  reports  (which  could 
potentially  reflect  cover  and/or 
deception  activities)  but  also  on  the 
relationship  of  that  indicator  to  other 
indicators  within  the  context  of  threat 
scenarios. 


Another  aspect  of  the  knowledge 
acquisition  process  will  be  concerned 
with  the  data  input  problem.  The 
objective  of  this  element  of  the  pro- 
posed effort  would  be  to  acquire 
knov.  ledge  for  the  following: 


• Identifying  from  the  masses  of 
collected  data  those  processed 
sensor  and  intelligence  systems 
outputs  that  are  relevant  to  tac- 
tical warning  (for  example, 
information  about  movements  of 
units  of  relatively  small  size  or 
the  deployment  of  certain  types 
of  equipment  may  be  insignifi- 
cant if  considered  within  the 
warning  context). 
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An  example  of  a criterion  for  activat- 
ing an  indicator  called  "Artillery  well 
forward  and  massed"  is  given  in  Table 
3.  It  should  be  noted  that  the  last  two 
bullets  of  the  IF  portion  of  the  table 
are  statements  about  active  indica- 
tors. 


The  knowledge  acquisition  process 
must  also  address  tactical  I and  W 
tasks  pertaining  to  unconventional 
(nuclear)  battlefield  environments.  Of 
course,  significant  constraint  on 
threat  assessment  for  such  environ- 
ments is  the  unprecedented  nature. 
Obviously,  large-scale  engagements 
with  enemy  forces  in  critical  areas  of 
the  world  (such  as  Europe)  might 
create  novel  and  previously  untested 
situations.  In  such  cases,  I and  W 
analysis  would  be  performed  largely  on 
the  basis  of  expert  knowledge  and 
judgements  about  expected  capabil- 
ities of  new  weapons,  hypothetical 
enemy  tactics  in  potentially  unconven- 
tional environments,  and  so  on.  Table 
4 gives  an  example  of  a criterion  for 
activating  an  indicator  which 
describes  likely  deployment  of  nuclear 
weapons. 


• Assigning  these  sensors  and 
intelligence  information  com- 
ponents to  the  appropriate 
report  categories  and  para- 
meters developed  as  a result  of 
the  data  organization  effort. 

The  successful  performance  of  the 
first  task  will  significantly  improve 
the  efficiency  of  analyzing  large 
amounts  of  data. 

The  second  task  will  contribute  to  the 
development  of  capabilities  for  auto- 
mated input  or  data  to  the  tactical  I 
and  W expert  system. 

Finally,  knowledge  acquisition  is  an 
iterative  process  as  shown  in  Figure  3. 


PROTOTYPE  SYSTEM  DESIGN 


ESL's  approach  to  the  prototype 
system  design  will  consist  of  the 
following  steps: 
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Table  3.  Example  Activation  Rule 


IF 


Within  the  last  two  hours  it  has  been  observed  that 

• All  organic  artillery  batteries  in  the  divisional  sector  DS7  are  in  place. 

• They  are  complemented  by  several  non-organic  batteries. 

• These  batteries  are  within  1/3  or  less  of  their  maximum  range  behind  the 
FLOT  and  in  close  lateral  proximity  to  several  potential  key  friendly 
targets . 

• The  above  information  is  generated  from  an  imagery  sensor  of  highly 
reliability,  and  the  sensor  timeliness  factor  is  less  than  30  minutes. 

• There  is  an  increase  in  artillery-related  communications  in  DS7. 

• An  increase  of  logistic  build-up  in  DS7  has  been  detected. 

THEN 


Activate  the  indicator  "Artillery  is  well  forward  and  massed"  with  high 
probability. 


Knowledge  Representation 

In  the  field  of  artificial  intelligence,  a 
representation  of  knowledge  is  a com- 
bination of  data  structures  and  inter- 
pretative procedures  (i.e  , scheme  for 
symbolically  describing  oart  of  the 
world).  If  appropriately  used  in  a 
program,  thp$e  structures  and  proce- 
dures can  lead  to  a knowledgeable 
behavior.  Research  on  knowledge 
representation  in  Al  has  involved  the 
design  of  several  types  of  structures 
for  strong  info  nation  in  computer 
programs  and  tb  . construction  of  pro- 
cedures to  manipulate  these  structures 
for  the  purpose  of  making  inferences. 

A representation  method  that  has  been 
used  in  most  of  the  successfully  devel- 
oped expert  systems  is  based  on  the 
idea  of  representing  knowledge  in  the 
form  of  rules  or  productions.  A rule  is 


simply  a condition-action  pair.  IF  this 
condition  holds,  THEN  take  this 
action.  In  Table  3,  the  example  of  an 
indicator  activation  criterion  is 
already  expressed  in  the  form  of  a 
rule.  The  IF  part  contains  the  condi- 
tions or  premises  and  the  THEN  part  is 
the  conclusion  or  action.  If  the  condi- 
tions are  satisfied,  llien  Hie  rule  can 
fire,  that  is,  its  conclusion  is  executed 
by  the  program.  The  rules  examine  a 
data  structure,  called  the  context, 
which  means  to  represent  the  current 
state  of  the  world  and  check  to  see  if 
their  IF  parts  are  true  in  that  state,  in 
which  case  the  THEN  parts  can  fire. 
In  an  I and  W expert  system,  the 
context  will  be  comprised  of  incoming 
specific  sensor  and  intelligence 
reports,  order  of  battle,  geographic 
and  military  tactics  knowledge 
reflected  in  the  conditions  of  the  rules 
and  conclusions  of  rules  that  have 
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Table  4.  Example  Activatior  Rule 


In  the  divisional  sector  it  has  been  observed  within  the  last  six  hours  that 

• Units  are  dispersing. 

• Troops  are  digging  in,  hasty  locations  are  being  fortified. 

• There  is  an  increase  in  medical  units,  transports,  and  so  on. 

• Special  decontamination  equipment  is  observed  in  enemy  area. 

• Enemy  soldiers  are  observed  carrying  nuclear,  biological,  and  chemical 
(NBC)  protective  equipment. 

• Cheraical/nuclear  ammunition/delivery  means  are  observed. 

• There  is  an  increase  or  notable  existance  of  special,  secure 
communications  traffic. 

• There  is  an  increase  in  meterological/target  acquisition  activity. 

• Wind/ weather  conditions  favor  enemy  use  of  NBC. 


THEN 


Activate  the  indicator  "Enemy  is  likely  to  use  NBC  weapons  in  next  24  hours" 
with  50%  probability  if  no  NBC  use  was  made  sooner,  otherwise  the  90% 
probability. 


Table  5.  Example  of  a Rule  for  Indicator  Relationships 


IF 


There  is  strong  evidence  that  artillery  is  well  forward  and  massed. 


THEN 


Expect  increased  levels  of  communications  and  engineering  operations  within  a 
time  period  of  at  most  two  hours. 
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already  fired.  For  example,  the  rule 
given  in  Table  5,  and  based  on  the 
scenario  in  Figure  I,  has  as  its  premise 
the  conclusion  of  the  rule  in  table  3. 
The  latter  becomes  part  of  the  con- 
text as  soon  as  the  corresponding  rule 
(in  Table  3)  has  fired.  Such  rule 
changing  is  a convenient  representa- 
tion of  the  tactical  warning  process  as 
a causal  sequence  of  active  indicators 
along  a time  line. 

The  above  examples  of  rules  also 
demonstrate  another  important  repre- 
sentation feature  already  mentioned  in 
the  proceding  section— the  ability  of 
expert  systems  to  deal  with  facts  and 
knowledge  that  are  less  than  certain. 
Rule  conclusions  can  be  either  quali- 
fied by  expressions  such  as  "likely", 
"highly  probable",  "strongly  sugges- 
tive", and  so  on,  or  assigned  some 
certainty  or  probabilistic  numerical 


factors.  Both  ways  are  acceptable  to 
expert  systems  since  they  can  perform 
symbolic  reasoning  as  well  as  numer- 
ical computations.  Furthermore,  each 
segment  of  the  conditional  part  of  a 
rule  (each  expression  between  ANDs) 
can.  have  its  own  certainty  factor  or 
qualifier. 

Mathematical  formulas  or  additional 
heuristics  can  combine  these  factors 
and  assign  a certainty  value  to  the 
conclusion. 

In  addition  to  the  concept  of  a rule, 
expert  systems  design  utilizes  n vari- 
ety of  other  representation  tech- 
niques. One  such  technique  which  has 
turned  out  to  be  particularly  suitable 
for  the  development  of  a prototype 
strategic  I and  W analysis  expert  sys- 
tem sponsored  by  ESL's  IR&D  program 
is  based  on  the  idea  of  frames. 


Figure  3 
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Frames  provide  a structure  within 
which  new  data  are  interpreted  in 
terms  of  concepts  acquired  through 
previous  experience.  The  organization 
of  this  knowledge  facilitates  expecta- 
tion driven  processing,  that  is,  looking 
for  things  that  are  expected  based  on 
the  current  context.  This  type  of 
reasoning  is  made  possible  by  the  use 
of  knowledge  hooks,  or  slots  (the 
places  where  knowledge  fits  within  the 
larger  context  created  by  the  frame). 
For  example,  the  specific  report  in 
Table  2 is  already  represented  in  the 
form  of  a frame.  The  slots  are  the 
report  parameters.  They  have  been 
created  on  the  basis  of  expected 
observations  which  would  characterize 
enemy  operations  on  repairing  roads 
and  bridges.  Furthermore,  the  slots 
are  also  organized  in  terms  of  require- 
ments to  support  indicator  activation. 
Thus,  assessments  about  increased 
engineering  operations  will  be  made  on 
the  basis  of  locations  of  road  and 
bridge  repairs,  the  number  and  size  of 
engineering  units  involved,  terrain 
information  to  provide  further  evi- 
dence of  the  scope  of  the  enemy's 
effort,  source  or  sources  of  the 
reports  in  order  to  determine  their 
credibility,  and  so  on.  The  siot  values 
are  determined  by  sensor  and  intePi- 


Table  6.  A Frame-Based 


gence  data  and  by  information  that 
may  be  inherited  from  more  generic 
frames.  For  instance,  the  information 
in  the  unit  ID  slot  in  Table  2 may  be 
derived  from  a generic  report  cate- 
gory frame  because  of  strong  expecta- 
tions to  observe  this  type  of  personnel 
and  vehicles. 

Data  input  and  inheritance  are  only 
part  of  the  available  slot-filling  mech- 
anisms. The  voltrs  of  certain  types  of 
slots  can  be  der«  »ed  as  the  result  of 
rules  or  heuristics  operating  on  infor- 
mation provldec  b>  other  slots.  For 
instance,  each  specific  report  frame 
may  contain  a slot  called  "unusual- 
ness". Its  value  may  be  determined  on 
the  basis  of  slot  information  similar  to 
the  one  in  Table  2 and  would  indicate 
the  importance  of  the  particular 
report  in  the  context  of  tactical  warn- 
ing. In  Al  terminology,  such  slot  fill- 
ing mechanisms  are  called  procedural 
attachments. 

The  concept  of  frames  is  a convenient 
representation  form  not  only  for 
reports  but  also  for  indicators  and 
even  the  rules  themselves.  An 
example  of  an  indicator  represented  as 
a frame  is  given  in  Table  6.  Suitable 
slots  for  a rule  frame  would  include 


of  an  Indicator 


Name: 

Instance  of: 

Reports  Supporting  Activity-. 


‘ \ 


S'.' 


. .N 


V 

'v 


§ 


3 


ft 


Rules  for  Activation: 
Related  Indicators: 


Increased  engineering  operations. 

Indicator 

Road  and  bridge  repairs,  construction,  equipment 
in  forward  areas,  clearing  mines  and  obstacles. 

Rule  1,  Rule  2, . . . 

Artillery  well  forward  and  massed,  increased 
surveillance, . . . 
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v*  •, 

n r 


v'.  •-V-'-vV/.v' 


IF 


User  Interaction 


THEN 

Indicators  supported 
Source  of  this  rule 

Rules  that  might  countermand  this 
rule. 


Data  Input 

This  phase  of  the  design  effort  will 
investigate  the  development  of  proce- 
dures which  would  allow  the  automatic 
frame-based  generation  of  reports 
from  sensor  and  intelligence  data. 
The  performance  of  this  task  will  util- 
ize the  following  factors: 

• Most  of  the  sensor  and  intelli- 
gence outputs  are  already  for- 
matted. 

• The  vocabulary  of  the  sensors 
and  intelligence  messages  is 
based  on  standard  military  ter- 
minology qnd,  therefore,  con- 
strained within  manageable 
limits.  Thus  it  will  not  be  neces- 
sary to  apply  natural  language 
understanding  technology  which 
is  still  too  complex  and  in  many 
respects,  unreliable. 

• Frame-based  structures  provide 
a natural  environment  for  repre- 
senting sensor  and  intelligence 
data. 

• The  knowledge  acquisition  effort 
will  strongly  emphasize  the 
development  of  simple  heuristics 
which  could  provide  mechanisms 
for  initial  data  screening.  For 
example,  expert  judgment  rules 
could  eliminate  a number  of  data 
items  based  on  time,  location, 
and  subjects  that  are  likely  tc  ' e 
covered  by  these  items. 


The  prototype  expert  system  will  pro- 
vide the  basis  for  the  development  of 
a computer-based  system  for  training 
of  I and  W analysts.  Thus,  user  inter- 
action considerations  will  play  an 
important  role  in  the  design  efforts. 
The  design  phase  will  address  the 
development  of  the  following  user 
interaction  capabilities. 

Explanation  Facility 

The  representation  and  control  struc- 
ture techniques,  together  with  the 
tools  provided  by  symbolic 
manipulation  programming  environ- 
ments, facilitate  the  development  of 
capabilities  for  easy  access  to  the  line 
of  reasoning  for  any  inference  made 
by  the  system. 


Modification,  Change,  and  Addition  of 
Knowledge 

One  important  feature  of  expert  sys- 
tems is  its  modularity.  Rules  behave 
like  independent  pieces  of  knowledge. 
They  can  be  added,  deleted,  or 
changed  without  affecting  the  rest  of 
the  rules,  since  rules  communicate 
only  by  means  of  the  context  data 
structure  and  do  not  call  each  other 
directly.  Such  capabilities  can  sub- 
stantially enhance  I and  W analysis 
training.  The  user  can  perform  simu- 
lations, access  the  effects  of  changing 
indicator  activation  rules  on  decisions 
about  expected  threat  developments 
and  tactical  warning,  and  so  forth. 

The  design  efforts  will  also  identify  an 
appropriate  rule  syntax  which  would 
facilitate  the  user's  access  to  the  pro- 
gram. Furthermore,  the  system  will 
be  designed  in  such  a way  that  user- 
supplied  changes,  modifications,  and 
additions  of  rules  for  the  purposes  of 


tests  and  simulations  do  not  per- 
manently affect  the  system's  know- 
ledge base.  The  latter  should  be 
altered  in  a significant  way  only  by 
experts  during  periodic  system  main- 
tenance reviews. 


Graphics 

Appropriate  graphics  capabilities  will 
be  developed  for  a meaningful  display 
of  data  and  inferences  performed  by 
the  system. 


IMPLEMENTATION  AND  TESTING 


The  system  implementation  will  be 
performed  on  ESL's  Xerox-1100  Scien- 
tific Processor,  within  the 
INTERLISP-D  programming  environ- 
ment, which  has  a number  of  special 
capabilities  for  implementing  expert 
systems  and  a variety  of  display  and 
graphics  functions. 

The  system  will  be  developed  in  an 
incremental  and  iterative  fashion 
through  frequent  tests  and  refine- 
ments. f-or  example,  during  the  know- 
ledge acquisition  phase  experts  are 
unlikely  to  present  all  of  the  relevant 
facts  and  relationships  for  expert  per- 
formance in  the  domain  of  tactical  I 
and  W analysis.  Many  pertinent 
details  about  domain  knowledge  may 
be  supplied  by  the  experts  in  the 
course  of  their  examination  and  cri- 
tique of  the  performance  of  various 
system  modules.  These  procedures 
would  also  result  in  refining  and  aug- 
menting such  system  capabilities  as 
explanation,  display,  user  interaction, 
and  so  on. 


CONCLUSIONS 


This  paper  has  presented  an  expert 
systems  approach  to  aid  tactical  I and 
W analysts  in  the  performance  of  such 
tasks  as  indicator  activation,  informa- 
tion requirements  collection  tasking, 
and  tactial  warning.  The  main  know- 
ledge engineering  ideas  are  based  on 
our  ongoing  work  on  strategic  I and  W 
expert  system  development. 
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